Michael Stutz shows us how to recover deleted files using lsof command.

From the article: There you are, happily playing around with an audio file you’ve spent all afternoon tweaking, and you’re thinking, “Wow, doesn’t it sound great? Lemme just move it over here.” At that point your subconscious chimes in, “Um, you meant mv, not rm, right?” Oops. I feel your pain — this happens to everyone. But there’s a straightforward method to recover your lost file, and since it works on every standard Linux system, everyone ought to know how to do it.

Briefly, a file as it appears somewhere on a Linux filesystem is actually just a link to an inode, which contains all of the file’s properties, such as permissions and ownership, as well as the addresses of the data blocks where the file’s content is stored on disk. When you rm a file, you’re removing the link that points to its inode, but not the inode itself; other processes (such as your audio player) might still have it open. It’s only after they’re through and all links are removed that an inode and the data blocks it pointed to are made available for writing.

This delay is your key to a quick and happy recovery: if a process still has the file open, the data’s there somewhere, even though according to the directory listing the file already appears to be gone.

Hi, I just managed to recover a script, that was still running in an endless loop, but I deleted the File: ./doit & rm doit lsof | grep doit (you get the PID, you get the INUM also, but that did not help) cat /proc//fd/255 (outputs the script)

I have moved files from a directory to a computer on the network and have since discovered that the drive they were moved to is bad. It is my sense that moving and deleting are largely the same process, is there a best way to recover the files from the directory they were moved from? THANKS! -jim-

Hello all, All the files in my directory has been accidentally deleted on an SGI server using the rm -r command. None of the files are backed up. Please, can anyone help me out with possibility of recovering my files? It will highly be appreciated and acknowledged. Thanks.